System and method for using agent-based distributed reasoning to manage a computer network

Abstract

The present invention describes a system and method for using agent-based distributed reasoning to manage a computer network. In particular, the system includes interface agents to integrate event streams, distributed reasoning agents, and response agents, which run on hosts in the network. An interface agent monitors a resource in the network and reports an event to an appropriate distributed reasoning agent. The distributed reasoning agent, using one or more knowledge bases, determines a response to the event. An appropriate response agent implements the response. Characteristics of the reasoning agent's mean that they can work together collaboratively, as well as implementing parallel algorithms.

Description

FIELD OF THE INVENTION [0001] The present invention relates to systems and methods for using agent-based distributed reasoning to manage computer networks. In particular, the present invention relates to systems and methods that use agents and distributed reasoning to detect a situation occurring within a computer network by analyzing events, determining whether they relate to situations that require automated response, and automatically responding to the event based on the analysis. BACKGROUND OF THE INVENTION [0002] In the following discussion certain articles and methods will be described for background and introductory purposes. Nothing contained herein is to be construed as an “admission” of prior art. Applicant expressly reserves the right to demonstrate, where appropriate, that the articles and methods referenced herein do not constitute prior art under the applicable statutory provisions. [0003] Recent cyber-attacks on major corporate and government computer networks and Wor...

AI Technical Summary

Benefits of technology

[0009] The present invention provides systems and methods for using agent-based distributed reasoning to manage a computer network. In particular, the present invention combines an agent framework and distributed reasoning with available management or security tools to provide automatic, adaptive response capability and distributed, decentralized, yet coordinated decision-making capability, to enable effective and efficient management of computer networks.

[0013] As part of managing the computer networks, the present invention attempts to make this process as easy as possible for the user of the invention. In a typical installation, many components and component configurations are duplicated within a computer network either because they consist of the same hardware and software, or because they are used for similar function within the network (i.e. user workstations in an accounting department). To ease management of these “like” components, the system of the present invention allows them to be grouped together, and managed as a single entity. The grouping mechanism of the present invention is extremely flexible in which components can be added to groups based on type or function. This grouping supports both “is-a” and “has-a” relationships.

[0016] Because the reasoning mechanism of the invention utilizes multiple reasoning agents that can be coupled together via the agent framework, it is possible for them to seamlessly share data structures that comprise their working memories. Appropriate portions of the agents' working memories can be kept synchronized using message passing mechanisms within the agent framework that are transparent to the user of the invention, and because of this it is possible for multiple reasoning agents to work together collaboratively implementing parallel distributed algorithms that correlate events that occur over multiple hosts.

Problems solved by technology

Such attacks cost organizations resources, time and money.

These tools, however, suffer from many shortcomings.

Among these shortcomings, a lack of interoperability has limited effectiveness of a network management scheme based on these tools.

However, because they are typically designed to operate independently of each other, they are neither interoperable nor capable of cooperating with each other.

This lack of interoperability results in important system and security information being placed in numerous locations within a computer network, placing an undue burden on network administrators, who are forced to monitor a variety of data and reports.

Further, the lack of interoperability increases a risk of overlooking important situations.

Since there is currently no effective tool to do such tasks, it falls upon network administrators, further increasing a burden on them and increasing a risk of overlooking events that indicate time critical situations.

Other limitations of existing network management tools and OS features include: (1) they work from a centralized location within a network; and (2) they may not be compatible with one another.

These limitations further increase a burden on network administrators by necessitating configuration of multiple machines within a network and by increasing an amount of data and reports that need to be analyzed to detect an event.

Although parallel processing and distributed algorithms are sometimes used in the scientific programming community, they have not routinely been applied in computer and network management.

Images